Skip to content
Software development
ASD ISMISM-2067

ASD ISM 2067 Ensure single logout for single sign-on web applications

What it says

Web applications that support Single Sign On equally support Single Logout.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Web apps with Single Sign-On should also log users out from all connected services.

When you log out of a system that uses Single Sign-On (SSO), this control ensures you are automatically logged out of all related services, not just the one you're leaving. This is important because if you forget to log out from multiple places, someone else might gain unauthorised access to your accounts, risking your company's sensitive information.

Why it matters

Without Single Logout in SSO, ending a session in one app may not terminate sessions in other linked apps, enabling unauthorised access to organisational data.

How to implement

  1. The IT team should ensure that the Single Sign-On system is configured to support Single Logout.

    This can be done by checking settings in the SSO software that enable logout actions to extend across all connected services.

  2. System administrators should regularly test the Single Logout process to confirm it works as expected.

    They can simulate user actions to log out from one application and verify that it successfully ends sessions on all integrated applications.

  3. Security officers should inform employees about the importance of using Single Logout.

    This can be included in regular cyber security training sessions to raise awareness of secure login and logout practices.

  4. HR and IT should collaborate to update new employee onboarding processes.

    Include specific guidance on how to use SSO and the importance of completing logout actions to protect company data.

  5. The IT support team should create easy-to-follow guides for employees, explaining how to use Single Logout.

    This can include step-by-step instructions with screenshots or short video tutorials, ensuring everyone follows the same method.

Keep it running

Verify SSO Single Logout ends IdP and all relying-party sessions; test browser/back-button and multi-tab scenarios after changes to SSO or app integrations.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The configuration settings of the Single Sign-On system.

    Look at

    The enabled features to check that Single Logout is activated across all integrated services.

    Good evidence

    Shows Single Logout is consistently applied for every connected application.

  2. Check 2 of 5What an auditor asks for

    Look at

    These to see if they reflect successful Single Logout processes across multiple applications.

    Good evidence

    Will include timestamps indicating simultaneous logout from all systems.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Documentation of SSO testing procedures.

    Look at

    The testing records for evidence of regular checks on the Single Logout functionality.

    Good evidence

    Will provide dates and outcomes of these tests, verifying that Single Logout works as intended.

  4. Check 4 of 5What an auditor asks for

    Good evidence

    Includes training completion records from all relevant staff members.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Incident reports involving user sessions.

    Look at

    These in terms of any breaches or issues due to failed logouts.

    Good evidence

    Would be an absence of such incidents, or records showing that any found issues were quickly addressed.

Mappings

Closest match in ISO/IEC 27001: A.8.26, Defining security requirements for applications, which this control supports.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.26Defining security requirements for applicationsSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.